Klassen, V. (2011) Privacy and Cloud-Based Educational Technology in British Columbia Vancouver BC: BCCampus
This discussion paper is probably the most important paper I have read this year regarding the future of e-learning in Canada. It is essential reading not just for institutional CIOs, but also for any instructor wanting to use Google Docs, Facebook, or any other social media where the data is stored ‘in the cloud.’
Basically it examines the tension between British Columbia’s privacy law and the use of social media, particularly those hosted on U.S. servers (which is the majority at the moment), but also would apply to data stored on other foreign servers (e.g. in India) that have less stringent privacy laws than British Columbia. It is deliberately meant as a discussion document to bring better alignment between the Office of the Privacy Commissioner and practice in British Columbia’s post secondary educational institutions. It is based on discussions with BC institutions about what and how instructors are doing with social media and its relationship to the law.
I can do no better than quote from the document to give you some idea of the issues addressed:
Besides streaming video, instructors and students are using other social media such as blogs, Facebook pages, instant messaging, Twitter, Google Docs, and other third party, U.S.-based social media services to collaborate in a learning environment. These services offer many advantages: they are inexpensive, robust, feature-rich, intuitive to the user, easy to access and easy to share with peers. They also offer many disadvantages: chief of which is the risk to privacy and security of user’s personal information posed by these services.
Social media services are commercial ventures. They earn revenue from advertisers or partners who use the data voluntarily submitted by users to target their marketing efforts. In other words: the commercial product bought and sold isn’t the social media application itself, rather it is the users themselves and the rich, detailed information they willingly provide online about their consumer habits.
Social media companies are almost exclusively based in the United States, where the provisions of the Patriot Act apply no matter where the information originates. The Patriot Act allows the U.S. government to access the social media content and the personally identifying information without the end users’ knowledge or consent.
The government of British Columbia, concerned with both the privacy and security of personal information, enacted a stringent piece of legislation to protect the personal information of British Columbians. The Freedom of Information and Protection of Privacy Act (FIPPA) mandates that no personally identifying information of British Columbians can be collected without their knowledge and consent, and that such information not be used for anything other than the purpose for which it was originally collected.
The paper found that institutional policies regarding this issue not surprisingly are all over the map. In particular, it is clear that individual instructors in British Columbia are risking falling foul of the law, mainly through ignorance, but in some cases willfully. BCCampus and the institutions are to be praised for trying to clarify the issue with BC’s Privacy Commissioner, who appears willing to work with the institutions on this matter. In the meantime, here are my personal comments on the issue.
1. Thank God we have a strong privacy law in British Columbia. We need protection from government intrusion into our privacy. I want to be free to talk about the reasons that drive terrorists to murder people without being put on a no-fly list without appeal. Secondly I don’t want my personal information or that of my students sold to third parties merely because in an online course we discuss the value of different products for teaching online, or because we access collectively a range of commercial web-based sites for the purpose of study.
2. However, trying to stop instructors and students from using social media because the data are hosted outside Canada is futile. If we are to secure our privacy, we will need to find ways of making consensual choices and knowing the risks we take when we do this.
3. The Patriot Act is probably the worst legislation ever passed by the US government. An act of panic in a moment of threat. It is immensely damaging to the USA’s trade, as well as removing essential democratic protections from its citizens. That’s the business of the USA, but it also affects the rest of the world, as anyone who tries to cross the border or do business in the USA immmediately discovers. It is certainly a constraint on the use of web 2.0 tools in education.
4. But where is Canadian business on this issue? Where are the Canadian sites or services offering social media? My web site is hosted in Canada, but it is much easier to find companies in the USA or overseas offering social media services, and they are usually cheaper due to the laws of supply and demand. All the talk by the Canadian Federal government about the digital economy is pretty meaningless if no-one is hosting server farms and social media in Canada.
5. This is an interesting example of the tensions in globalization. The USA has created and made available social media to the world, but at the same time wants the world to follow its laws and customs (Google Books is another example of an American company trying to over-ride the rights of authors in other countries). Perhaps the answer to the issue of privacy and social media lies in international rather than national law, but that will take so long we will have moved on to something else – and anyway, the USA ignores international law when it suits its purpose.
These are just personal ramblings, but I do strongly recommend that you read this paper. It sets out the issues clearly, although it offers no immediate solutions.
See also: Clint Lalonde (2011) Privacy and cloud based apps – a background paper from BCcampus ClintLalonde.net, March 25
Thanks to both David Porter and Stephen Downes for directing me to this.